2020 State Privacy Roundup: Incremental Change, Major Momentum for California

This article is a yearly deep dive into the nation’s newly enacted privacy laws, capturing the key trends and milestones that defined 2020.

Introduction

The number of consumer privacy bills introduced across the United States increased significantly in 2020 compared to 2019, including several proposals for comprehensive state privacy laws. Legislatures also considered numerous bills addressing the collection and use of biometric information, facial recognition technologies, and other emerging privacy issues.

Despite this heightened legislative activity, the COVID-19 pandemic disrupted legislative sessions across the country and shifted lawmakers' attention to emergency public health and economic measures. As a result, relatively few major privacy laws were enacted. California remained the clear leader by expanding its comprehensive consumer privacy framework, while other states adopted narrower measures addressing specific industries or data practices.

The principal privacy enactments of 2020 included:

• Michigan’s SB 172 modifies requirements for insurers providing privacy notices to customers
• Virginia’s SB 101 allows a merchant to scan the machine-readable zone of an individual’s driver’s license for verification purposes, but requires the merchant to destroy the retained information when the purpose for which it was provided and retained has been satisfied.
• California AB 82 requires data broker registration fees to be used to offset costs for an internet website where the information provided by data brokers is accessible to the public.
• California AB 713 exempts from the Consumer Privacy Act information that was deidentified in accordance with specified federal law or policy.
• California AB 1281 exempts from the CCPA certain employment information and personal information involved in business-to-business communications and transactions.

The most significant privacy development of 2020 occurred on November 3, 2020, when California voters approved  Proposition 24 , the California Privacy Rights Act (CPRA). The CPRA substantially amended the California Consumer Privacy Act (CCPA) by creating new consumer rights, including the rights to correct inaccurate personal information, opt out of the sharing of personal information for cross-context behavioral advertising, and limit the use and disclosure of sensitive personal information, such as precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric information, health information, information concerning a person's sex life or sexual orientation, and the contents of certain private communications. The law also introduced data minimization and storage limitation principles by requiring businesses to retain personal information only for as long as reasonably necessary to fulfill the disclosed purposes for which it was collected, increased administrative penalties for certain violations involving consumers under the age of 16, and established the California Privacy Protection Agency (CalPrivacy) as the nation's first dedicated privacy regulator with authority to implement and enforce California's privacy laws. Although approved by voters in 2020, most substantive provisions of the CPRA will became operative on January 1, 2023.

State-by-State Summary of 2020 Enactments

The legislation summarized below focuses on laws regulating the privacy practices of commercial entities, online services, and commercial websites. It includes measures addressing consumer data privacy — such as online privacy, the collection of biometric data, data broker regulation, and other miscellaneous consumer privacy issues. Regulations solely related to data breaches are excluded.

Arizona: No enactments

California:

Proposition 24 was enacted as a ballot initiative. It further expands the state’s consumer data privacy laws by permitting consumers to: (1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information” — such as precise geolocation; race; ethnicity; religion; genetic data; union membership; private communications; and certain sexual orientation, health, and biometric information. It prohibits businesses’ retention of personal information for longer than reasonably necessary and triples maximum penalties for violations concerning consumers under age 16. It established a California Privacy Protection Agency to enforce and implement consumer privacy laws, and impose administrative fines.

In addition:

• CA AB 82 (Enacted): This bill would require data broker registration fees to be deposited in the Data Brokers’ Registry Fund, which the bill would create in the State Treasury, to be available for expenditure by the Department of Justice, upon appropriation by the Legislature, to offset costs for an internet website where the information provided by data brokers is accessible to the public.
• CA AB 713 (Enacted): Excepts from the Consumer Privacy Act information that was deidentified in accordance with specified federal law, was derived from medical information, protected health information, individually identifiable health information, or identifiable private information, consistent with specified federal policy. Prohibits a business or other person from reidentifying information that was deidentified, unless a specified exception is met.
• CA AB 1138(Enacted by Vetoed): Prohibits a person or business that conducts business in the state, and that operates a social media website or application, from allowing a person under a specified age to create an account with the website or application, unless the website or application obtains the consent of the person’s parent or guardian before creating the account using a method that includes reasonable measures to ensure that the person giving their consent is the parent or legal guardian of such person.
• CA AB 1281 (Enacted): Extends exemptions from the Consumer Privacy Act certain information collected by a business about a natural person in the course of that person acting as a job applicant, employee, owner, director, officer, medical staff member, or contractor and personal information reflecting a written or verbal communication or a transaction between a business and a consumer, until a specified date.
• CA SB 980 (enacted but vetoed): Establishes the Genetic Information Privacy Act. Prohibits a direct to consumer genetic or illness testing services company from disclosing a person’s genetic information to a third party without obtaining the person’s prior written consent. Requires actions for relief to be prosecuted exclusively by a District Attorney, county counsel, city attorney, or city prosecutor.

Connecticut: No enactments in 2020

Florida: No enactments in 2020

Hawaii: No enactments in 2020

Idaho: No enactments in 2020

Illinois: No enactments in 2020

Louisiana: No enactments in 2020

Massachusetts: No enactments in 2020

Maryland: No enactments in 2020

Maine: No enactments in 2020

Michigan:

• MI SB 172 (Enacted) Modifies requirements for insurers providing privacy policies to customers.

Minnesota: No enactments in 2020

Missouri: No enactments in 2020

Mississippi: No enactments in 2020

Nebraska: No enactments in 2020

New Hampshire: No enactments in 2020

New Jersey: No enactments in 2020

New York: No enactments in 2020

Pennsylvania: No enactments in 2020

Rhode Island: No enactments in 2020

South Carolina: No enactments in 2020

South Dakota: No enactments in 2020

Tennessee: No enactments in 2020

Utah: No enactments in 2020

Virginia:

• VA SB 101 (Enacted): Relates to scanning information from driver’s license, allows a merchant to scan the machine-readable zone of an individual’s Department of Motor Vehicles issued identification card or driver’s license in order to verify authenticity of such or to verify the identity of the individual when the individual requests a service pursuant to a membership or a service agreement, allows the merchant to conduct such a scan for identity verification.

Vermont: No enactments in 2020

Washington: No enactments in 2020

Wisconsin: No enactments in 2020

West Virginia: No enactments in 2020

Puerto Rico: No enactments in 2020

Resources

NCLS Research at: https://www.ncsl.org/research/telecommunications-and-information-technology/2020-consumer-data-privacy-legislation637290470.aspx